Privacy Policy
Last updated: 27 October 2026
This policy explains how JRS Romania uses the personal data it receives through jrsromania.org and through the contact details shown on it. People who take part in our programmes receive separate information when their data is collected.
Who is responsible for your data
The data controller is Asociația Serviciul Iezuiților pentru Refugiați din România (JRS Romania), registered office: 54 Maior Ilie Opriș Street, Sector 4, Bucharest, Romania, entered in the Register of Associations and Foundations under no. 229/02.05.2000, tax identification code 13046611.
For any question or request about your personal data, please write to jrsromania@gmail.com or to our registered office.
What data we use and why
| Situation | Data | Why we use it | Legal basis |
|---|---|---|---|
| You visit the website | IP address, browser and device type, pages visited, date and time | To run the website and keep it secure | Our legitimate interest in a secure, working website (Article 6(1)(f) GDPR) |
| You accept optional cookies | Data about your visit and how you use the website | Visitor statistics and measuring campaigns on Facebook and Instagram | Your consent (Article 6(1)(a) GDPR). Details in our Cookie Policy. |
| You donate online | First name, surname, email, amount, currency, date and frequency of the donation. Payment details are entered directly with Stripe or PayPal; JRS Romania does not receive the full card number. | To process and confirm your donation and, for monthly donations, to take the recurring payment | Performance of the donation you requested (Article 6(1)(b) GDPR) |
| You donate online | Data in the accounting records of the donation | To keep accounting records | Legal obligation under Romanian Accounting Law no. 82/1991 (Article 6(1)(c) GDPR) |
| You donate by bank transfer | Account holder’s name, IBAN, amount, date and payment details, as shown on the bank statement | To record the donation and for accounting purposes | Legal obligation under the Romanian Accounting Law no. 82/1991 (Art. 6(1)(c) GDPR) |
| You contact us (email, phone, partnership form) | Name, organisation, email, phone, content of your message | To reply and, where relevant, to discuss a partnership | Our legitimate interest in responding to enquiries (Article 6(1)(f) GDPR) or steps taken at your request before entering into a contract (Article 6(1)(b) GDPR) |
| You sign up as a volunteer (volunteering form) | Full name, email, town or city, areas of interest, availability, languages spoken and any other information you choose to share | To review your application, contact you and agree on volunteering activities together | Steps taken at your request before entering into a volunteering contract (Art. 6(1)(b) GDPR) |
| You send a report through the Safeguarding contact line | Your message; your name and email only if you provide them. The message may include information about health, violence or children. | To assess the report and take the steps needed to protect the people concerned | Our legitimate interest in preventing and responding to abuse, exploitation and neglect (Article 6(1)(f) GDPR); where applicable, a legal obligation to notify the authorities (Article 6(1)(c)) or the protection of a person’s vital interests (Article 6(1)(d)). For health and other special category data: Article 9(2)(c) and (f) GDPR. |
| You apply for a job | Your CV, the information you send us, interview results | For the recruitment process | Steps taken at your request before entering into a contract (Article 6(1)(b) GDPR). Keeping your CV for future vacancies only with your consent (Article 6(1)(a)). |
| You submit a bid in a procurement procedure | Data of the bidder’s representatives (name, position, contact details, signature) | To run the procedure and to justify expenditure to funders | Legal obligation regarding procurement rules and record-keeping in funded projects (Article 6(1)(c) GDPR); entering into and performing the contract (Article 6(1)(b)) where the bidder is an individual; otherwise, our legitimate interest (Article 6(1)(f)). |
We do not use your data for automated decisions that have legal effects on you.
Who receives your data
Only JRS Romania staff who need the data for the purposes above have access to it. We use the following providers, which process data on our behalf or in connection with their services:
- Automattic (WordPress.com), for website hosting, including video files, and for visitor statistics;
- Stripe and PayPal, for payment processing;
- BRD – Groupe Société Générale, the bank through which we receive donations by bank transfer;
- Google (Gmail), for the email service through which we receive messages;
- Google Ireland (Google Analytics), for visitor statistics, only if you accept statistics cookies;
- Complianz, the consent module installed on the website, for managing cookie choices. Your choice is stored in your browser;
- Meta Platforms, only if you accept marketing cookies or choose to load our Facebook page on the website;
- Google (YouTube), for video playback, only after you start a video.
We may share data with public authorities, funders and auditors where the law or funding agreements require it.
Transfers outside the EEA
Some providers may process data outside the European Economic Area, including in the United States. In these cases, transfers rely on the safeguards provided for in the GDPR: the provider’s certification under the EU–US Data Privacy Framework or the standard contractual clauses adopted by the European Commission. For Automattic, the standard contractual clauses apply.
How long we keep your data
We keep data only for as long as needed for the purpose for which we received it, or for as long as the law requires:
- accounting records of donations: 5 years from 1 July of the year following the end of the financial year; other donation data: 5 years from your last donation;
- messages and partnership enquiries: 3 years from the last correspondence;
- volunteer applications: 2 years from the date the form is submitted;
- safeguarding reports: for the duration of the assessment and 5 years after the case is closed;
- job applications: 6 months after the recruitment ends or, with your consent, 2 years for future vacancies;
- procurement bids: as long as the funding rules require; for EU funds, usually 5 years from 31 December of the year of the last payment in the project;
- technical website data and records of cookie choices: according to our providers’ settings.
Your rights
You have the right to request access to your data, to have it corrected or erased, to restrict its processing and to data portability. You may object to processing based on our legitimate interest. Where processing is based on consent, you may withdraw it at any time; this does not affect processing carried out before withdrawal.
To exercise your rights, please write to jrsromania@gmail.com. We reply within one month; this may be extended by two further months for complex requests, in which case we will let you know.
You may lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), 28-30 G-ral. Gheorghe Magheru Boulevard, Sector 1, Bucharest, anspdcp@dataprotection.ro, www.dataprotection.ro.
Cookies
Information about cookies is in our Cookie Policy. You can change your choice at any time using the button below.
Updates
We update this policy when the way we use data changes. Last updated: 23 October 2026.